Zammo API Lab · Agent tool server

CivicTools MCP

A live view of what MCP clients are doing: the authentication handshake they walk, the tools they discover, and the arguments they actually send. Base URL https://civic-tools.apilab.zammo.ai.

Exchanges

Tool calls

Refused

Registered clients

Cases held

Live activity

updating every 2s

Nothing yet. Connect an MCP client to one of the endpoints below.

Endpoints

MCP server URL	Authentication	What a client must do
`https://civic-tools.apilab.zammo.ai/mcp/open`	Open	No authentication. Proves the transport and tool execution in isolation.
`https://civic-tools.apilab.zammo.ai/mcp/api-key`	API key	Static header: X-CivicTools-Key. The pattern a hand-provisioned MCP server uses.
`https://civic-tools.apilab.zammo.ai/mcp/oauth`	OAuth, pre-registered client	Authorization code with PKCE using the documented client id. No registration step.
Signs in through `https://identity.apilab.zammo.ai` Resource metadata `https://civic-tools.apilab.zammo.ai/.well-known/oauth-protected-resource/mcp/oauth`
`https://civic-tools.apilab.zammo.ai/mcp/dcr`	OAuth with Dynamic Client Registration	Refuses any client id it did not issue: the client must register itself first (RFC 7591). Deprecated by the MCP spec and kept for backwards compatibility.
Signs in through `https://identity.apilab.zammo.ai/legacy` Resource metadata `https://civic-tools.apilab.zammo.ai/.well-known/oauth-protected-resource/mcp/dcr`
`https://civic-tools.apilab.zammo.ai/mcp/cimd`	OAuth with a Client ID Metadata Document	Refuses anything but a URL client_id. The client identifies itself with an HTTPS URL serving its own metadata, and never registers (the MCP spec's preferred mechanism).
Signs in through `https://identity.apilab.zammo.ai` Resource metadata `https://civic-tools.apilab.zammo.ai/.well-known/oauth-protected-resource/mcp/cimd`

Development credentials

API key header (/mcp/api-key)	`X-CivicTools-Key: civic-tools-key-7b41d9`
Pre-registered client (/mcp/oauth)	`civic-tools-client` `civic-tools-secret`

Authorization server

OAuth runs on the lab's shared identity server on port 8090, not on CivicTools itself. You never paste these into a client: it finds them from the MCP server URL. They are here for inspecting the handshake.

Registration endpoint	`https://identity.apilab.zammo.ai/oauth/register`
Metadata	`https://identity.apilab.zammo.ai/.well-known/oauth-authorization-server`
Metadata without CIMD (the legacy issuer; which endpoint uses which is shown above)	`https://identity.apilab.zammo.ai/.well-known/oauth-authorization-server/legacy`